A code path in the Linux kernel’s mlx5e networking driver mishandles a counter that tracks how many eswitch mode operations are blocking a device. When an IPsec acquisition security association is processed, the counter is decremented without a corresponding increment, causing an underflow and resulting in an incorrect negative reference count. This faulty state can lead the kernel to crash, which disables the affected node and provides a denial‑of‑service condition. The flaw is a classic example of integer underflow and improper counter management, aligning with CWE‑191.

All Linux kernel releases that incorporate the mlx5e driver and contain the eswitch IPsec offload path before the patch is applied are vulnerable. The vulnerability affects any kernel built from the commit range referenced in the provided repository links, so systems running older or unpatched kernel versions that enable eswitch mode for IPsec offload fall into the affected set. No specific vendor or product version identifiers are listed beyond the Linux kernel itself.

The CVSS score of 8.8 reflects a high severity impact, but the EPSS score is listed as < 1% and the vulnerability is not included in the CISA KEV catalog, indicating that real-world exploitation is currently considered unlikely. Based on the description, it is inferred that successful compromise would generally require the ability to influence IPsec configuration or inject acquisition requests that reach the driver, which typically limits the threat to users with local or privileged access. However, hosts that accept external IPsec traffic and enable eswitch mode could be exposed if an attacker can craft traffic that triggers the offload path.